Function setRequireAuth

packages/http-routes/src/auth.ts:24–26

(enabled: boolean)

 * Used for server/headless deployments where same-origin assumption doesn't hold.
 */
export function setRequireAuth(enabled: boolean): void {
  requireAuthEnabled = enabled
}

// Compare via HMAC digests (fixed 32-byte length) to avoid leaking token length
const hmacKey = randomBytes(32)